Ao you cloud Browser Remote privacy Leak Vulnerability (certain conditions are required)

Ao you cloud Browser Remote privacy Leak Vulnerability (certain conditions are required)

The intent protocol header is used for browser resolution. If the processing problem is solved, the unexported component can be opened remotely, and information can be obtained by passing parameters.

Because intent filtering is not strict, you can remotely open the activity and execute


 

<Script> location. href = "intent: # Intent; S. url = file: // mnt/sdcard/test.html; component = com. mx. browser/com. mx. browser. navigation. mxFullscreenWebviewActivity; end "; </script>

Premise: test.html is an html file that obtains privacy (through the file field). It is first stored on the SD card.

 

Solution:

Parse intent protocol headers